SharpLDAPmonitor HackTool Execution on Windows

title: SharpLDAPmonitor HackTool Execution on Windows
id: e78d6978-be9e-407d-b495-5090fff5acad
status: test
description: This rule identifies execution of SharpLDAPmonitor by matching either the executable name/path (SharpLDAPmonitor.exe) or its OriginalFileName metadata. It further looks for command-line arguments consistent with LDAP querying (including /user:, /pass:, and /dcip:). Such tooling can be used to monitor LDAP object changes, which may support reconnaissance and persistence-oriented activity. The detection relies on Windows process creation telemetry fields including Image, OriginalFileName, and CommandLine.
references:
  - https://github.com/p0dalirius/LDAPmonitor
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sharp_ldap_monitor.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-30
modified: 2023-02-14
tags:
  - attack.discovery
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \SharpLDAPmonitor.exe
    - OriginalFileName: SharpLDAPmonitor.exe
  selection_cli:
    CommandLine|contains|all:
      - "/user:"
      - "/pass:"
      - "/dcip:"
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 9f8fc146-1d1a-4dbf-b8fd-dfae15e08541
    type: derived